Privacy Policy
1. Who we are
This policy explains how [[COMPANY NAME]] ("Sanctum", "we", "us") handles personal data when you use sanctum.cash and the Sanctum wallet at app.sanctum.cash (together, the "Service"). We are the controller for the data described below. Our address: [[REGISTERED ADDRESS]]. Contact: [[CONTACT EMAIL]].
2. What data we process
| Data | When |
|---|---|
| Email address | When you sign in. It identifies your account and is where we send one-time codes. |
| One-time sign-in codes (stored hashed), sign-in time, session token (stored hashed) | While you sign in and use the Service. |
| IP address | When you request a sign-in code (used for abuse prevention) and in server logs. |
| Wallet address and wallet keys | When your account is created. The wallet is created and secured by us; the private key is stored encrypted. |
| Transaction records | Top-ups you start (amount, currency, status, reference) and transfers you make (recipient address, amount, transaction hash, status). |
| Technical data | Browser type, device information, request timestamps and error logs, kept in server logs. |
| Messages you send us | If you contact us by email. |
We do not see or store your card number. Card payments are handled by our payment partner (see section 4). The sign-in session token is kept in your browser's local storage so you stay signed in; we do not use advertising or analytics cookies.
3. Why we use it
- To provide the Service (create your account and wallet, sign you in, process top-ups and transfers, show your balance and history). Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
- Security and abuse prevention (rate limits, fraud and misuse detection, keeping the Service stable). Legal basis: legitimate interests, Art. 6(1)(f) GDPR.
- Legal obligations (accounting, tax, anti-money-laundering and sanctions rules, answering lawful requests from authorities). Legal basis: Art. 6(1)(c) GDPR.
- Support when you contact us. Legal basis: Art. 6(1)(b) or (f) GDPR.
We do not sell your personal data and we do not use it for advertising.
4. Who we share it with
- Payment partner. Card, Apple Pay and Google Pay top-ups are run by our payment partner, Wert (wert.io). When you buy USDC, you share payment and, where required, identity information directly with them, under their own terms and privacy policy. We receive the status and amount of the order and the receiving wallet address.
- Email delivery. Our email service provider sends your sign-in codes ([[EMAIL PROVIDER]]).
- Hosting and infrastructure. Our servers and related infrastructure providers process data on our behalf ([[HOSTING PROVIDER]]).
- Blockchain network. Transfers are published on the Base network (see section 6).
- Authorities and advisers. Where the law requires it, or to establish, exercise or defend legal claims, and to our professional advisers under confidentiality.
5. How long we keep it
- Sign-in codes expire after 10 minutes and sessions after 12 hours.
- Account, wallet and transaction records are kept while your account exists and afterwards for as long as legal retention rules require ([[RETENTION PERIOD, e.g. 10 years]]).
- Server logs are kept for a limited period for security and troubleshooting ([[LOG RETENTION, e.g. 30 days]]).
When data is no longer needed, we delete or anonymise it.
6. Blockchain data
Transfers are recorded on the public Base blockchain. Wallet addresses, amounts and transaction hashes are visible to everyone and cannot be changed or deleted by us or anyone else. Please keep this in mind before you send funds.
7. Your rights
Under the GDPR and similar laws you can ask us for access to your data, correction, deletion, restriction of processing, a copy of the data you gave us (portability) and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. Write to [[CONTACT EMAIL]]. You also have the right to complain to your local data protection authority. Deletion requests may be limited where we must keep records by law or where data is on the blockchain.
8. Security
We use technical and organisational measures to protect your data, including encrypted storage of wallet keys, hashed codes and tokens, encrypted connections (HTTPS) and rate limiting. No system is completely secure, so please protect access to your email account.
9. Changes and contact
We may update this policy when the Service or the law changes. The date at the top shows the latest version. Questions: [[CONTACT EMAIL]].